ACME Profile (ACME certificate profile)

An ACME profile is an extension to ACME: the CA lists its available profiles, each with a short description, under meta.profiles in its directory, and the client adds a profile field to its newOrder request. Let's Encrypt announced its profiles on 2025-01-09: classic (the default), tlsserver and shortlived. The shortlived profile issues six-day (160-hour) certificates; these, and IP address certificates through the same profile, became generally available on 2026-01-15.

Why it matters

Profiles let a CA change certificate contents without surprising every client at once. Let's Encrypt's 45-day plan, announced by ISRG on 2025-12-02, relies on them: the tlsserver profile has issued 45-day certificates since 2026-05-13, while the default classic profile moves to 64 days with 10-day authorization reuse from 2027-02-10, then to 45 days with 7-hour authorization reuse from 2028-02-16. Profiles also carried the end of client authentication: the classic profile stopped including the clientAuth EKU on 2026-02-11, and the tlsclient profile was discontinued on 2026-07-08.

Example

List the profiles Let's Encrypt offers, then request one in a new order:

curl -s https://acme-v02.api.letsencrypt.org/directory | jq .meta.profiles

{
  "identifiers": [{ "type": "dns", "value": "example.com" }],
  "profile": "tlsserver"
}

Clients that support profiles expose this as an option; others keep receiving the default classic profile.

Common misconceptions

• The profile is chosen in the CSR. It is a field of the ACME order; the CSR only supplies the key and names.
• The default profile will always issue today's lifetime. Under the published plan, classic shrinks to 64 days from 2027-02-10 and to 45 days from 2028-02-16.
• Short-lived certificates still need OCSP or CRL pointers. Under Ballot SC-063, certificates of 7 days or less issued from 2026-03-15 need not carry them; their short life is the protection.